Rubygem-katello: katello: denial of service and potential information disclosure via sql injection
Priority LOW 24CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.
Summary
A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Fix Fixed katello (RubyGems): 4.19.1Red Hat: 3 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.14.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.1.23-0.3.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.2.0-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.2.28-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 2.22.3-1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.27.10-2.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.5.1-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.4.3-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.16.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.13.0-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 6.17.7-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.0.3-4.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.14.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.1.23-0.3.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.2.0-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.2.28-0.1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 2.22.3-1.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 3.27.10-2.el9pc | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 1.5.1-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.4.3-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 4.16.0.14-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.13.0-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 6.17.7-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | 0.0.3-4.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | 4.18.0.9-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | 4.20.0.4-1.el9sat | Patch available | CNA |
| Red Hat | Red Hat Satellite 6 | — | — | Not affected | CNA |
| — | katello (RubyGems) | before 4.19.1 | 4.19.1 | Patch available | GHSA-fwj4-6wgp-mpxm |
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.14.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.1.23-0.3.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.2.0-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.2.28-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 2.22.3-1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.27.10-2.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.5.1-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.4.3-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.16.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.13.0-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 6.17.7-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.0.3-4.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.14.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.1.23-0.3.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.2.0-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.2.28-0.1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 2.22.3-1.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.27.10-2.el9pc Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 1.5.1-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.4.3-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.16.0.14-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.13.0-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 6.17.7-1.el9sat Patch available CNA
- Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 0.0.3-4.el9sat Patch available CNA
- Red Hat Satellite 6.18 for RHEL 9 VendorRed Hat Affected — Fixed in 4.18.0.9-1.el9sat Patch available CNA
- Red Hat Satellite 6.19 for RHEL 9 VendorRed Hat Affected — Fixed in 4.20.0.4-1.el9sat Patch available CNA
- Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- katello (RubyGems) Vendor— Affected before 4.19.1 Fixed in 4.19.1 Patch available GHSA-fwj4-6wgp-mpxm
CPE names CNA · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:satellite:6.17::el9 | 6.17 | — | Red Hat |
| cpe:/a:redhat:satellite_capsule:6.17::el9 | 6.17 | — | Red Hat |
| cpe:/a:redhat:satellite_maintenance:6.17::el9 | 6.17 | — | Red Hat |
| cpe:/a:redhat:satellite_utils:6.17::el9 | 6.17 | — | Red Hat |
| cpe:/a:redhat:satellite:6.18::el9 | 6.18 | — | Red Hat |
| cpe:/a:redhat:satellite_capsule:6.18::el9 | 6.18 | — | Red Hat |
| cpe:/a:redhat:satellite_utils:6.18::el9 | 6.18 | — | Red Hat |
| cpe:/a:redhat:satellite:6.19::el9 | 6.19 | — | Red Hat |
| cpe:/a:redhat:satellite_capsule:6.19::el9 | 6.19 | — | Red Hat |
| cpe:/a:redhat:satellite_maintenance:6.19::el9 | 6.19 | — | Red Hat |
- cpe:/a:redhat:satellite:6.17::el9 Versions 6.17 — ·Red Hat
- cpe:/a:redhat:satellite_capsule:6.17::el9 Versions 6.17 — ·Red Hat
- cpe:/a:redhat:satellite_maintenance:6.17::el9 Versions 6.17 — ·Red Hat
- cpe:/a:redhat:satellite_utils:6.17::el9 Versions 6.17 — ·Red Hat
- cpe:/a:redhat:satellite:6.18::el9 Versions 6.18 — ·Red Hat
- cpe:/a:redhat:satellite_capsule:6.18::el9 Versions 6.18 — ·Red Hat
- cpe:/a:redhat:satellite_utils:6.18::el9 Versions 6.18 — ·Red Hat
- cpe:/a:redhat:satellite:6.19::el9 Versions 6.19 — ·Red Hat
- cpe:/a:redhat:satellite_capsule:6.19::el9 Versions 6.19 — ·Red Hat
- cpe:/a:redhat:satellite_maintenance:6.19::el9 Versions 6.19 — ·Red Hat
Remediation
- Fix · GHSA-fwj4-6wgp-mpxm katello (RubyGems) Fixed in 4.19.1 Advisory →
Red Hat 3 advisories
- RHSA-2026:22326 Released 2026-06-01 · Red Hat rating ModerateSatellite 6.19.1 Async Update
- Red Hat Satellite 6.19 for RHEL 9 dynflow-utils-2.0.1-1.el9sat, rubygem-katello-4.20.0.4-1.el9sat
- RHSA-2026:5970 Released 2026-03-26 · Red Hat rating ImportantSatellite 6.17.7 Async Update
- Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.14-1.el9sat, foreman-cli-3.14.0.14-1.el9sat, foreman-debug-3.14.0.14-1.el9sat +33
- RHSA-2026:5968 Released 2026-03-26 · Red Hat rating ImportantSatellite 6.18.4 Async Update
- Red Hat Satellite 6.18 for RHEL 9 foreman-3.16.0.12-1.el9sat, foreman-cli-3.16.0.12-1.el9sat, foreman-debug-3.16.0.12-1.el9sat +15
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:5970 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:5968 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:22326 |
Not affected: 3 products
- Red Hat Satellite 6
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4324
- 2026-10-03 Alias added: GHSA-fwj4-6wgp-mpxm
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-4324 · CVE Program
- CVE-2026-4324 · NVD
- FIRST EPSS
- GHSA-fwj4-6wgp-mpxm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-4324 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences